Major Incidents or Breaches

  • Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
  • Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
  • An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
  • The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
  • eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
  • Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

  • Ivanti released security updates for two zero-day remote code execution (RCE) vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both of which have been actively exploited.
  • SolarWinds patched four critical vulnerabilities in its Web Help Desk product, including unauthenticated RCE and authentication bypass flaws.
  • Multiple critical vulnerabilities were identified in the n8n automation platform, allowing unauthenticated remote code execution and server hijacking via sandbox and AST sanitization flaws.
  • Microsoft issued an emergency patch for a Microsoft Office zero-day that allowed malicious documents to bypass security checks.
  • Researchers found 175,000 publicly exposed Ollama AI servers across 130 countries, creating a significant attack surface for exploitation.
  • Android theft protection features were updated by Google to strengthen device authentication and recovery.

Notable Threat Actor Activity

  • A new Android malware campaign abused the Hugging Face platform to distribute thousands of APK payload variants targeting financial and payment credentials.
  • Chinese APT groups deployed advanced malware against organisations in Asia, indicating ongoing high-end cyber-espionage operations.
  • The Aisuru (Kimwolf) botnet executed a record-setting DDoS attack in December 2025, peaking at 31.4 Tbps and 200 million requests per second.
  • Flare researchers highlighted how infostealer malware is being distributed via malicious Roblox game mods, enabling lateral movement from home PCs to corporate environments.
  • An operation dubbed “Bizarre Bazaar” targeted exposed large language models (LLMs) and managed control panels (MCPs) for commercial monetization.
  • The Clawdbot malware rebranded as Moltbot, sparking impersonation and supply chain risk campaigns.

Trends, Tools, or Tactics of Interest

  • SentinelOne and Censys reported a widespread issue of unmanaged, publicly accessible AI deployments, specifically Ollama servers, posing risks to data privacy and security.
  • The use of “semantic chaining” in prompt engineering was shown to bypass content controls in LLMs such as Gemini Nano Banana and Grok 4 by splitting malicious prompts into discrete segments.
  • The IPIDEA proxy network relied on SDKs embedded in mobile and desktop applications to enroll compromised devices into its proxy service.
  • The Global Cybersecurity Outlook 2026 and industry commentary emphasize the need for improved vulnerability management, preparation for quantum threats, and responsible AI deployment.
  • A survey of over 100 energy sector OT systems revealed pervasive cybersecurity gaps in substations, power plants, and control centers.
  • Microsoft Teams will introduce a feature to report suspicious calls as potential scams or phishing attempts by mid-March 2026.

Regulatory or Policy Developments

  • The Trump administration rescinded Biden-era guidance requiring U.S. federal agencies to solicit software bills of materials (SBOMs) and compliance attestations with NIST’s Secure Software Development Framework (SSDF) from vendors.
  • The French data protection authority imposed a €5 million fine on the national unemployment agency for inadequate security measures leading to a data breach.